Teach updater how to do multi-directory version pull requests

updater/lib/dependabot/dependency_change.rb

@@ -81,7 +81,7 @@ def should_replace_existing_pr?
       # NOTE: Gradle, Maven and Nuget dependency names can be case-insensitive
       # and the dependency name injected from a security advisory often doesn't
       # match what users have specified in their manifest.
-      updated_dependencies.map { |x| x.name.downcase } != job.dependencies.map(&:downcase)
+      updated_dependencies.map { |x| x.name.downcase }.uniq.sort != job.dependencies.map(&:downcase).uniq.sort
     end
 
     def matches_existing_pr?

updater/lib/dependabot/updater/operations/create_group_update_pull_request.rb

@@ -41,8 +41,6 @@ def perform
 
           Dependabot.logger.info("Starting update group for '#{group.name}'")
 
-          dependency_change = compile_all_dependency_changes_for(group)
-
           if dependency_change.updated_dependencies.any?
             Dependabot.logger.info("Creating a pull request for '#{group.name}'")
             begin
@@ -64,6 +62,26 @@ def perform
                     :dependency_snapshot,
                     :error_handler,
                     :group
+
+        def dependency_change
+          return @dependency_change if defined?(@dependency_change)
+
+          if job.source.directories.nil?
+            @dependency_change = compile_all_dependency_changes_for(group)
+          else
+            dependency_changes = job.source.directories.map do |directory|
+              job.source.directory = directory
+              # Fixes not updating because it already updated in a previous group
+              dependency_snapshot.handled_dependencies.clear
+              compile_all_dependency_changes_for(group)
+            end
+
+            # merge the changes together into one
+            @dependency_change = dependency_changes.first
+            @dependency_change.merge_changes!(dependency_changes[1..-1]) if dependency_changes.count > 1
+            @dependency_change
+          end
+        end
       end
     end
   end

updater/lib/dependabot/updater/operations/refresh_group_update_pull_request.rb

@@ -87,7 +87,7 @@ def perform # rubocop:disable Metrics/AbcSize
               )
             end
 
-            dependency_change = compile_all_dependency_changes_for(dependency_snapshot.job_group)
+            dependency_change
 
             upsert_pull_request_with_error_handling(dependency_change, dependency_snapshot.job_group)
           end
@@ -99,6 +99,26 @@ def perform # rubocop:disable Metrics/AbcSize
                     :service,
                     :dependency_snapshot,
                     :error_handler
+
+        def dependency_change
+          return @dependency_change if defined?(@dependency_change)
+
+          if job.source.directories.nil?
+            @dependency_change = compile_all_dependency_changes_for(dependency_snapshot.job_group)
+          else
+            dependency_changes = job.source.directories.map do |directory|
+              job.source.directory = directory
+              # Fixes not updating because it already updated in a previous group
+              dependency_snapshot.handled_dependencies.clear
+              compile_all_dependency_changes_for(dependency_snapshot.job_group)
+            end
+
+            # merge the changes together into one
+            @dependency_change = dependency_changes.first
+            @dependency_change.merge_changes!(dependency_changes[1..-1]) if dependency_changes.count > 1
+            @dependency_change
+          end
+        end
       end
     end
   end